CVE-2026-7579 Details

A vulnerability exists in the AstrBot application developed by AstrBotDevs, specifically in versions up to 4.16.0. The issue arises from hard-coded credentials embedded within the dashboard authentication route. This vulnerability allows remote authentication bypass, granting unauthorized users administrative access. Additionally, the authentication process is vulnerable to a timing attack, enabling potential brute-force attempts on the password.

Users should be forced to change the default password upon the first login. All hard-coded credentials should be removed from the source code. Additionally, password comparisons should be done using a constant-time comparison method to prevent timing attacks, and simple string comparisons should be replaced with a secure hashing algorithm like Argon2 or bcrypt.